Strix
56.9K

CVE-2026-72232

HIGHCVSS 7.8/10EPSS 0.20%

Last modified

CVE-2026-72232 is a high-severity vulnerability rated 7.8/10 on the CVSS scale. In the Linux kernel, the following vulnerability has been resolved: batman-adv: ensure minimal ethernet header on TX As documented in commit 8bd67ebb50c0 ("net: bridge: xmit: make sure we have at least eth header len bytes"), it is possible by for a local user with eBPF TC hook access to attach a tc filter which truncates the packet and redirects to an batadv interface. But the code assumes that at least ETH_HLEN bytes are available and thus might read outside of the available buffer. The batadv_interface_tx() must therefore always check itself if enough data is available for the ethernet header and don't rely on min_header_len.. EPSS estimates a 0.20% chance of exploitation in the next 30 days.

Description

In the Linux kernel, the following vulnerability has been resolved: batman-adv: ensure minimal ethernet header on TX As documented in commit 8bd67ebb50c0 ("net: bridge: xmit: make sure we have at least eth header len bytes"), it is possible by for a local user with eBPF TC hook access to attach a tc filter which truncates the packet and redirects to an batadv interface. But the code assumes that at least ETH_HLEN bytes are available and thus might read outside of the available buffer. The batadv_interface_tx() must therefore always check itself if enough data is available for the ethernet header and don't rely on min_header_len.

Metrics

CVSS 3.1
7.8/10

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS Probability
0.20%

10.3th percentile

Probability of exploitation in the next 30 days. Learn more

Affected Software

Source: CNA advisory (CVE.org). NVD analysis pending.

VendorProductVersions
LinuxLinux>= c6c8fea29769d998d94fcec9b9f14d4b52b349d3, < 58799078afebd5115e052bf69ad6697f9759dd6f; >= c6c8fea29769d998d94fcec9b9f14d4b52b349d3, < 38cd10b0aeec755d89f78722a2b83f4088ff0cb0; >= c6c8fea29769d998d94fcec9b9f14d4b52b349d3, < 811fea37620f2097955d95ce81cfdba03fd30f1b; >= c6c8fea29769d998d94fcec9b9f14d4b52b349d3, < e6640923afee619d9fa82b07394dc9498e202304; >= c6c8fea29769d998d94fcec9b9f14d4b52b349d3, < 6b4f521e01257387906f8b969ad3450d8208d4e2; >= c6c8fea29769d998d94fcec9b9f14d4b52b349d3, < 9e16b6751a8206de0b865d99bb02771e6751d12d; >= c6c8fea29769d998d94fcec9b9f14d4b52b349d3, < dbeb4145d9778f922f459935da9a027750765a69; >= c6c8fea29769d998d94fcec9b9f14d4b52b349d3, < 49df66b7993c80b80c7eb9a84ba5b3410c8296a0
LinuxLinux2.6.38

References

Timeline

Published
Last Modified
Status
Received

Frequently Asked Questions

What is CVE-2026-72232?
In the Linux kernel, the following vulnerability has been resolved: batman-adv: ensure minimal ethernet header on TX As documented in commit 8bd67ebb50c0 ("net: bridge: xmit: make sure we have at least eth header len bytes"), it is possible by for a local user with eBPF TC hook access to attach a tc filter which truncates the packet and redirects to an batadv interface. But the code assumes that at least ETH_HLEN bytes are available and thus might read outside of the available buffer. The batadv_interface_tx() must therefore always check itself if enough data is available for the ethernet header and don't rely on min_header_len.
How severe is CVE-2026-72232?
CVE-2026-72232 has a CVSS score of 7.8/10 (HIGH severity). The EPSS model estimates a 0.20% probability of exploitation in the next 30 days.
How do I fix CVE-2026-72232?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

How Strix Helps

Related CVEs from 2026

View all 2026CVEs →

Are you affected by CVE-2026-72232?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST